K
Kurt H
I have a 2-node Windows 2000 Advanced Server cluster
running File and Print services and Exchange 2000. Quite
often I find the print spooler service crashing and
unable to restart. In most cases I can restart the
service by using the cluster resource monitor in Cluster
Administrator and simply bringing the resource back
online. In rare cases the entire File and Print group
containing the Print Spooler resource will hang which
requires the active node of the server to actually be
rebooted or shut down to force the group to fail over.
I have been trying to troubleshoot this issue for months
because it is very annoying, but I can't find any
indication of what exactly is causing the print spooler
to crash, or what precise error message it is throwing.
Given this I have been reduced to trial and error and so
far I have been unsuccessful. I've tried several hotfixes
from Microsoft without luck, and I'm on the most current
service pack and hotfix levels (SP4).
I would like general assistance in troubleshooting
Windows Print Spooler issues, especially in a cluster
environment. I need to somehow log or diagnose what the
error condition is when the print spooler terminates so
that I can figure out what I need to change to correct
the problem.
I have the following output from the DRWTSN32.LOG file
but I am unable to decipher the exact cause of the error
from this information (below):
Application exception occurred:
App: spoolsv.exe (pid=2664)
When: 8/26/2004 @ 13:22:16.219
Exception number: c0000005 (access violation)
*----> System Information <----*
Computer Name: *******
User Name: SYSTEM
Number of Processors: 1
Processor Type: x86 Family 6 Model 11 Stepping 1
Windows 2000 Version: 5.0
Current Build: 2195
Service Pack: 4
Current Type: Uniprocessor Free
Registered Organization: **********
Registered Owner: *************
*----> Task List <----*
0 Idle.exe
8 System.exe
280 SMSS.exe
300 CSRSS.exe
296 WINLOGON.exe
352 SERVICES.exe
364 LSASS.exe
468 termsrv.exe
592 svchost.exe
640 svchost.exe
764 msdtc.exe
872 amgrsrvc.exe
888 ati2plxx.exe
908 dcevt32.exe
924 dcstor32.exe
1008 inetinfo.exe
1032 LLSSRV.exe
1072 ntfrs.exe
1164 portmap.exe
1200 qlremote.exe
1228 regsvc.exe
1240 mstask.exe
1356 omaws32.exe
1376 SNMP.exe
1548 WinMgmt.exe
1576 winvnc.exe
1588 MsPMSPSv.exe
1604 svchost.exe
1620 beremote.exe
1812 svchost.exe
1852 clussvc.exe
1904 dfssvc.exe
1948 mssearch.exe
2080 resrcmon.exe
2172 diagorb.exe
2404 svchost.exe
2648 explorer.exe
2712 atiptaxx.exe
2664 spoolsv.exe
2756 DRWTSN32.exe
0 _Total.exe
(01000000 - 0100D000)
(77F80000 - 77FFD000)
(78000000 - 78045000)
(7C570000 - 7C628000)
(7C2D0000 - 7C332000)
(77D30000 - 77DA1000)
(77F40000 - 77F7E000)
(77E10000 - 77E75000)
(76A90000 - 76AA6000)
(75030000 - 75044000)
(75020000 - 75028000)
(75170000 - 751BF000)
(7C340000 - 7C34F000)
(77BF0000 - 77C01000)
(77980000 - 779A4000)
(75050000 - 75058000)
(77950000 - 7797A000)
(751C0000 - 751C6000)
(75150000 - 7515F000)
(77340000 - 77353000)
(77520000 - 77525000)
(77320000 - 77337000)
(77A50000 - 77B3F000)
(779B0000 - 77A4B000)
(773B0000 - 773DF000)
(77380000 - 773A3000)
(77830000 - 7783E000)
(77880000 - 7790E000)
(7C0F0000 - 7C151000)
(774E0000 - 77513000)
(774C0000 - 774D1000)
(77530000 - 77552000)
(71710000 - 71794000)
(70A70000 - 70AD5000)
(77360000 - 77379000)
(777F0000 - 777F5000)
(76120000 - 76160000)
(77820000 - 77827000)
(759B0000 - 759B6000)
(76980000 - 7699B000)
(68010000 - 68100000)
(77800000 - 7781E000)
(76620000 - 76630000)
(733E0000 - 733EE000)
(6AA00000 - 6AA18000)
(10000000 - 10008000)
(00D20000 - 00D34000)
(01410000 - 0141B000)
(01530000 - 01544000)
(76AB0000 - 76AB7000)
(76A70000 - 76A76000)
(67200000 - 67217000)
(76A80000 - 76A8D000)
(75640000 - 75647000)
(75630000 - 75637000)
(754C0000 - 754C8000)
(75610000 - 7561D000)
(6B460000 - 6B467000)
(01AE0000 - 01AEF000)
(782C0000 - 782CC000)
(777E0000 - 777E8000)
(74FD0000 - 74FEE000)
(75010000 - 75017000)
(76A50000 - 76A6F000)
(76B00000 - 76B13000)
(775A0000 - 77630000)
(7CA00000 - 7CA23000)
(7C740000 - 7C7C7000)
(77430000 - 77440000)
(782F0000 - 78535000)
(78280000 - 782B6000)
(76670000 - 7667E000)
(73930000 - 73940000)
(74FF0000 - 75002000)
(76020000 - 76053000)
(76AC0000 - 76AFE000)
(03DB0000 - 03FBE000)
(76B30000 - 76B6E000)
(73280000 - 732B7000)
(6B2C0000 - 6B2C5000)
(10020000 - 101A4000)
State Dump for Thread Id 0xa5c
eax=0006fd38 ebx=00000000 ecx=00000101 edx=00000000
esi=00000000 edi=00000030
eip=77f82926 esp=0006fbf0 ebp=0006fc60 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtReadFile
77f8291b b8a1000000 mov eax,0xa1
77f82920 8d542404 lea edx,
[esp+0x4] ss:00889ad7=????????
77f82924 cd2e int 2e
77f82926 c22400 ret 0x24
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0006FC60 7C2E4CD9 00000030 0006FD38 00000216 0006FC88
ntdll!NtReadFile
0006FC8C 7C2E4B5F 00000030 0006FD38 00000216 0006FCC4
advapi32!StartServiceCtrlDispatcherW
0006FD08 7C2E486E 00000030 0006FD38 00000216 0105F89C
advapi32!StartServiceCtrlDispatcherW
0006FF68 01001295 0100B030 01001265 00000001 00232428
advapi32!StartServiceCtrlDispatcherW
0006FFC0 7C581AF6 0105F89C 0105F1D4 7FFDF000 00000000
spoolsv!<nosymbols>
0006FFF0 00000000 01001170 00000000 000000C8 00000100
kernel32!OpenEventA
*----> Raw Stack Dump <----*
0006fbf0 d1 85 57 7c 30 00 00 00 - 00 00 00 00 00 00 00
00 ..W|0...........
0006fc00 00 00 00 00 38 fc 06 00 - 38 fd 06 00 16 02 00
00 ....8...8.......
0006fc10 00 00 00 00 00 00 00 00 - c4 fc 06 00 46 85 57
7c ............F.W|
0006fc20 38 fd 06 00 00 00 00 00 - 01 00 00 00 d8 55 07
00 8............U..
0006fc30 4c fd 06 00 00 00 00 00 - 5c 00 00 00 00 3d 07
00 L.......\....=..
0006fc40 68 0a 00 00 00 00 00 00 - 18 fc 06 00 f8 fc 06
00 h...............
0006fc50 f8 fc 06 00 97 e5 57 7c - 00 86 57 7c ff ff ff
ff ......W|..W|....
0006fc60 8c fc 06 00 d9 4c 2e 7c - 30 00 00 00 38 fd 06
00 .....L.|0...8...
0006fc70 16 02 00 00 88 fc 06 00 - 00 00 00 00 d8 55 07
00 .............U..
0006fc80 38 fd 06 00 00 00 00 00 - 00 00 00 00 08 fd 06
00 8...............
0006fc90 5f 4b 2e 7c 30 00 00 00 - 38 fd 06 00 16 02 00
00 _K.|0...8.......
0006fca0 c4 fc 06 00 9c f8 05 01 - 00 00 00 00 00 f0 fd
7f ................
0006fcb0 86 af d3 77 10 43 07 00 - 4c fd 06 00 00 00 00
00 ...w.C..L.......
0006fcc0 f4 fc 06 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
0006fcd0 80 55 07 00 00 3d 07 00 - b0 02 00 00 70 00 65
00 .U...=......p.e.
0006fce0 35 00 35 00 01 00 00 00 - 8d 4e 2e 7c 00 00 00
00 5.5......N.|....
0006fcf0 a4 fc 06 00 10 43 07 00 - 58 ff 06 00 49 56 2e
7c .....C..X...IV.|
0006fd00 58 50 2e 7c ff ff ff ff - 68 ff 06 00 6e 48 2e
7c XP.|....h...nH.|
0006fd10 30 00 00 00 38 fd 06 00 - 16 02 00 00 9c f8 05
01 0...8...........
0006fd20 d4 f1 05 01 00 f0 fd 7f - 00 ff 06 00 55 1f f8
77 ............U..w
State Dump for Thread Id 0x2b0
eax=00000001 ebx=00000000 ecx=0028fbb0 edx=00000000
esi=77f82865 edi=0000005c
eip=77f82870 esp=0028ff60 ebp=0028ff84 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtWaitForSingleObject
77f82865 b8ea000000 mov eax,0xea
77f8286a 8d542404 lea edx,
[esp+0x4] ss:00aa9e47=????????
77f8286e cd2e int 2e
77f82870 c20c00 ret 0xc
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0028FF84 7C573B50 0000005C FFFFFFFF 00000000 010012DF
ntdll!NtWaitForSingleObject
0028FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!WaitForSingleObject
State Dump for Thread Id 0x694
eax=00000004 ebx=00015f90 ecx=002cf884 edx=00000000
esi=000750d0 edi=00015f90
eip=77f8289c esp=002cfebc ebp=002cfee4 iopl=0 nv
up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000297
function: ZwRemoveIoCompletion
77f82891 b8a8000000 mov eax,0xa8
77f82896 8d542404 lea edx,
[esp+0x4] ss:00ae9da3=????????
77f8289a cd2e int 2e
77f8289c c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
002CFEE4 77D31394 00000040 002CFF1C 002CFF0C 002CFF14
ntdll!ZwRemoveIoCompletion
002CFF20 77D3E93F 00015F90 002CFF60 002CFF5C 002CFF70
rpcrt4!<nosymbols>
002CFF74 77D3E8C2 77D35924 000750D0 0028FAF2 77F83413
rpcrt4!RpcRevertToSelf
002CFFA8 77D358D6 00076F00 002CFFEC 7C57438B 00076F28
rpcrt4!RpcRevertToSelf
002CFFB4 7C57438B 00076F28 0028FAF2 77F83413 00076F28
rpcrt4!RpcBindingFree
002CFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x5b4
eax=77f47ddd ebx=00079a14 ecx=7ffd9000 edx=00000000
esi=00077a04 edi=0100b3c0
eip=77f47de8 esp=007dff80 ebp=77f82091 iopl=0 nv
up ei ng nz ac po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000296
function: GdiGetSpoolMessage
77f47ddd b8c2100000 mov eax,0x10c2
77f47de2 8d542404 lea edx,
[esp+0x4] ss:00ff9e67=????????
77f47de6 cd2e int 2e
77f47de8 c21000 ret 0x10
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
77F82091 4AFFC033 21850F08 89000008 FF900C42 8D0F044A
gdi32!GdiGetSpoolMessage
0424548B 00000000 00000000 00000000 00000000 00000000
<nosymbols>
State Dump for Thread Id 0x2ac
eax=778321fe ebx=00000004 ecx=0081f234 edx=00000000
esi=77f82873 edi=00000004
eip=77f8287e esp=00c7fd24 ebp=00c7fd70 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtWaitForMultipleObjects
77f82873 b8e9000000 mov eax,0xe9
77f82878 8d542404 lea edx,
[esp+0x4] ss:01499c0b=????????
77f8287c cd2e int 2e
77f8287e c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00C7FD70 7C578F0D 00C7FD48 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
00C7FFB4 7C57438B 00000005 000B000A 7C325107 0007D528
kernel32!WaitForMultipleObjects
00C7FFEC 00000000 778321FE 0007D528 00000000 000000C8
kernel32!TlsSetValue
*----> Raw Stack Dump <----*
00c7fd24 23 3c 57 7c 04 00 00 00 - 48 fd c7 00 01 00 00
00 #<W|....H.......
00c7fd34 00 00 00 00 00 00 00 00 - 01 00 00 00 28 d5 07
00 ............(...
00c7fd44 01 00 00 00 e4 00 00 00 - e8 00 00 00 f8 00 00
00 ................
00c7fd54 84 01 00 00 38 bd 46 80 - c8 d2 bb 84 00 00 00
00 ....8.F.........
00c7fd64 f4 00 00 00 11 00 00 00 - 02 00 00 00 b4 ff c7
00 ................
00c7fd74 0d 8f 57 7c 48 fd c7 00 - 01 00 00 00 00 00 00
00 ..W|H...........
00c7fd84 00 00 00 00 00 00 00 00 - b2 22 83 77 04 00 00
00 .........".w....
00c7fd94 b0 fe c7 00 00 00 00 00 - ff ff ff ff 28 d5 07
00 ............(...
00c7fda4 07 51 32 7c 0a 00 0b 00 - a8 05 21 e3 ac 05 21
e3 .Q2|......!...!.
00c7fdb4 a0 81 e7 85 00 00 00 00 - 01 00 00 00 38 00 00
00 ............8...
00c7fdc4 23 00 00 00 23 00 00 00 - 0a 00 0b 00 07 51 32
7c #...#........Q2|
00c7fdd4 28 d5 07 00 ff ff ff ff - 34 f2 81 00 fe 21 83
77 (.......4....!.w
00c7fde4 f8 8b fd 7f 33 43 57 7c - 1b 00 00 00 00 02 00
00 ....3CW|........
00c7fdf4 fc ff c7 00 23 00 00 00 - 26 5a 45 80 80 1b 6d
be ....#...&ZE...m.
00c7fe04 08 12 ff 84 08 12 ff 84 - 40 00 00 00 24 1b 6d
be ........@...$.m.
00c7fe14 9d 01 45 80 00 fc ad 84 - 00 00 00 00 00 00 00
00 ..E.............
00c7fe24 28 72 c3 84 1e 53 49 80 - 28 72 c3 84 b8 00 00
00 (r...SI.(r......
00c7fe34 40 9a e7 85 03 00 10 00 - 08 12 ff 84 40 9a e7
85 @...........@...
00c7fe44 20 12 ff 84 08 12 ff 84 - 0c 12 ff 84 28 72 c3
84 ...........(r..
00c7fe54 a4 1b 6d be 01 00 00 00 - e0 fc ad 84 01 00 00
00 ..m.............
State Dump for Thread Id 0x590
eax=00000005 ebx=00000002 ecx=00cdf03a edx=00000000
esi=77f82873 edi=00000002
eip=77f8287e esp=00cdf838 ebp=00cdf884 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtWaitForMultipleObjects
77f82873 b8e9000000 mov eax,0xe9
77f82878 8d542404 lea edx,
[esp+0x4] ss:014f971f=????????
77f8287c cd2e int 2e
77f8287e c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00CDF884 77E119E6 00CDF85C 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
00CDF8E0 77E11ACE 00CDF8AC 00CDF928 FFFFFFFF 000000FF
user32!MsgWaitForMultipleObjectsEx
00CDF8FC 76A951A8 00000001 00CDF928 00000000 FFFFFFFF
user32!MsgWaitForMultipleObjects
FFFFFFFF 00000000 00000000 00000000 00000000 00000000
spoolss!EnumPrinterDriversW
*----> Raw Stack Dump <----*
00cdf838 23 3c 57 7c 02 00 00 00 - 5c f8 cd 00 01 00 00
00 #<W|....\.......
00cdf848 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
00cdf858 02 00 00 00 40 01 00 00 - 74 03 00 00 00 00 00
00 [email protected].......
00cdf868 70 f8 cd 00 00 00 00 00 - 70 f8 cd 00 70 f8 cd
00 p.......p...p...
00cdf878 ad aa e2 77 00 00 00 00 - 00 00 00 00 e0 f8 cd
00 ...w............
00cdf888 e6 19 e1 77 5c f8 cd 00 - 01 00 00 00 00 00 00
00 ...w\...........
00cdf898 00 00 00 00 00 00 00 00 - 7b 3a 57 7c e6 31 11
1b ........{:W|.1..
00cdf8a8 00 00 00 00 40 01 00 00 - 74 03 00 00 00 00 88
77 [email protected]
00cdf8b8 40 f9 cd 00 10 42 a9 76 - 9c 5d e3 77 00 00 88
77 @....B.v.].w...w
00cdf8c8 00 00 00 00 28 e5 09 00 - 00 00 00 00 cc 66 fd
7f ....(........f..
00cdf8d8 00 00 00 00 74 03 00 00 - fc f8 cd 00 ce 1a e1
77 ....t..........w
00cdf8e8 ac f8 cd 00 28 f9 cd 00 - ff ff ff ff ff 00 00
00 ....(...........
00cdf8f8 00 00 00 00 ff ff ff ff - a8 51 a9 76 01 00 00
00 .........Q.v....
00cdf908 28 f9 cd 00 00 00 00 00 - ff ff ff ff ff 00 00
00 (...............
00cdf918 db 1d 2d 7c 01 00 00 00 - b4 ff cd 00 00 00 00
00 ..-|............
00cdf928 40 01 00 00 00 00 00 00 - e0 b5 9e 01 05 00 00
00 @...............
00cdf938 05 00 00 00 02 00 00 00 - 01 00 00 00 b4 ff cd
00 ................
00cdf948 7e 98 a9 76 00 00 00 00 - 00 00 00 00 98 62 07
00 ~..v.........b..
00cdf958 69 00 6e 00 65 00 74 00 - 70 00 70 00 2e 00 64
00 i.n.e.t.p.p...d.
00cdf968 6c 00 6c 00 00 00 6c 00 - 00 00 00 00 00 00 00
00 l.l...l.........
State Dump for Thread Id 0x914
eax=76aa0364 ebx=00000001 ecx=00000000 edx=00000000
esi=77f82873 edi=00000001
eip=77f8287e esp=00d1ff0c ebp=00d1ff58 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtWaitForMultipleObjects
77f82873 b8e9000000 mov eax,0xe9
77f82878 8d542404 lea edx,
[esp+0x4] ss:01539df3=00000000
77f8287c cd2e int 2e
77f8287e c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00D1FF58 7C578F0D 00D1FF30 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
00D1FFB4 7C57438B 00000128 00000000 00000000 00233A88
kernel32!WaitForMultipleObjects
00D1FFEC 00000000 76AA0364 00233A88 00000000 00905A4D
kernel32!TlsSetValue
*----> Raw Stack Dump <----*
00d1ff0c 23 3c 57 7c 01 00 00 00 - 30 ff d1 00 01 00 00
00 #<W|....0.......
00d1ff1c 00 00 00 00 00 00 00 00 - 00 00 00 00 88 3a 23
00 .............:#.
00d1ff2c 00 00 00 00 54 01 00 00 - dc ff d1 00 97 e5 57
7c ....T.........W|
00d1ff3c f8 84 57 7c ff ff ff ff - 78 ff d1 00 16 19 34
77 ..W|....x.....4w
00d1ff4c 28 01 00 00 38 00 12 00 - 00 00 00 00 b4 ff d1
00 (...8...........
00d1ff5c 0d 8f 57 7c 30 ff d1 00 - 01 00 00 00 00 00 00
00 ..W|0...........
00d1ff6c 00 00 00 00 00 00 00 00 - c4 03 aa 76 01 00 00
00 ...........v....
00d1ff7c a8 ff d1 00 00 00 00 00 - ff ff ff ff 00 00 00
00 ................
00d1ff8c 00 00 00 00 88 3a 23 00 - 03 01 00 00 00 00 00
00 .....:#.........
00d1ff9c 00 00 00 00 00 00 00 00 - 54 01 00 00 54 01 00
00 ........T...T...
00d1ffac 00 00 00 00 53 03 aa 76 - ec ff d1 00 8b 43 57
7c ....S..v.....CW|
00d1ffbc 28 01 00 00 00 00 00 00 - 00 00 00 00 88 3a 23
00 (............:#.
00d1ffcc 00 a0 fd 7f 00 00 00 00 - c0 ff d1 00 00 00 00
00 ................
00d1ffdc ff ff ff ff 97 e5 57 7c - a8 a0 57 7c 00 00 00
00 ......W|..W|....
00d1ffec 00 00 00 00 00 00 00 00 - 64 03 aa 76 88 3a 23
00 ........d..v.:#.
00d1fffc 00 00 00 00 4d 5a 90 00 - 03 00 00 00 04 00 00
00 ....MZ..........
00d2000c ff ff 00 00 b8 00 00 00 - 00 00 00 00 40 00 00
00 ............@...
00d2001c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
00d2002c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
00d2003c 80 00 00 00 0e 1f ba 0e - 00 b4 09 cd 21 b8 01
4c ............!..L
State Dump for Thread Id 0x934
eax=6720102d ebx=00000001 ecx=00000000 edx=00000000
esi=77f82873 edi=00000001
eip=77f8287e esp=0199fed0 ebp=0199ff1c iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtWaitForMultipleObjects
77f82873 b8e9000000 mov eax,0xe9
77f82878 8d542404 lea edx,
[esp+0x4] ss:021b9db7=????????
77f8287c cd2e int 2e
77f8287e c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0199FF1C 7C578F0D 0199FEF4 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
0199FFB4 7C57438B 00000000 00CDE764 67201AD7 00000000
kernel32!WaitForMultipleObjects
0199FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x8cc
eax=0000114d ebx=019dff88 ecx=019dfc44 edx=00000000
esi=77f82865 edi=00000224
eip=77f82870 esp=019dff6c ebp=019dff90 iopl=0 nv
up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000297
function: NtWaitForSingleObject
77f82865 b8ea000000 mov eax,0xea
77f8286a 8d542404 lea edx,
[esp+0x4] ss:021f9e53=????????
77f8286e cd2e int 2e
77f82870 c20c00 ret 0xc
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
019DFF90 7C573B50 00000224 00015F90 00000000 76A82DEC
ntdll!NtWaitForSingleObject
019DFFEC 00000000 76A82DC3 76A8A040 00000000 00000008
kernel32!WaitForSingleObject
*----> Raw Stack Dump <----*
019dff6c 28 3b 57 7c 24 02 00 00 - 00 00 00 00 88 ff 9d
01 (;W|$...........
019dff7c 00 00 00 00 40 a0 a8 76 - 40 a0 a8 76 00 17 5b
ca [email protected]@..v..[.
019dff8c ff ff ff ff ec ff 9d 01 - 50 3b 57 7c 24 02 00
00 ........P;W|$...
019dff9c 90 5f 01 00 00 00 00 00 - ec 2d a8 76 24 02 00
00 ._.......-.v$...
019dffac 90 5f 01 00 10 1d 08 00 - b8 8b f8 77 8b 43 57
7c ._.........w.CW|
019dffbc 40 a0 a8 76 10 1d 08 00 - b8 8b f8 77 40 a0 a8
76 @[email protected]
019dffcc 00 40 fd 7f 30 e4 cd 00 - c0 ff 9d 01 30 e4 cd
00 [email protected]...
019dffdc ff ff ff ff 97 e5 57 7c - a8 a0 57 7c 00 00 00
00 ......W|..W|....
019dffec 00 00 00 00 00 00 00 00 - c3 2d a8 76 40 a0 a8
76 [email protected]
019dfffc 00 00 00 00 08 00 00 00 - 01 01 00 00 ee ff ee
ff ................
019e000c 00 00 00 00 00 00 c9 00 - 00 40 0b 00 00 00 9e
01 .........@......
019e001c 00 01 00 00 40 00 9e 01 - 00 00 ae 01 b7 00 00
00 ....@...........
019e002c 02 00 00 00 a8 05 c9 00 - 00 00 00 00 10 3d a2
01 .............=..
019e003c 00 00 00 00 24 00 08 00 - 01 01 0a 00 55 00 4e
00 ....$.......U.N.
019e004c 49 00 52 00 45 00 53 00 - 2e 00 44 00 4c 00 4c
00 I.R.E.S...D.L.L.
019e005c 00 00 53 00 54 00 44 00 - 4e 00 41 00 4d 00 45
00 ..S.T.D.N.A.M.E.
019e006c 53 00 2e 00 47 00 50 00 - 44 00 00 00 48 00 50
00 S...G.P.D...H.P.
019e007c 56 00 44 00 4a 00 35 00 - 30 00 2e 00 49 00 4e
00 V.D.J.5.0...I.N.
019e008c 49 00 00 00 48 00 50 00 - 56 00 55 00 44 00 35
00 I...H.P.V.U.D.5.
019e009c 30 00 2e 00 44 00 4c 00 - 4c 00 00 00 48 00 50
00 0...D.L.L...H.P.
State Dump for Thread Id 0x1ec
eax=76145ac9 ebx=0000000b ecx=77f87c5e edx=00000000
esi=77f82873 edi=0000000b
eip=77f8287e esp=01b2f9cc ebp=01b2fa18 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtWaitForMultipleObjects
77f82873 b8e9000000 mov eax,0xe9
77f82878 8d542404 lea edx,
[esp+0x4] ss:023498b3=????????
77f8287c cd2e int 2e
77f8287e c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
01B2FA18 76145BEC 00082FE8 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
01B2FFB4 7C57438B 019E64A8 00CDEB24 77F83413 019E64A8
localspl!SplConfigChange
01B2FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
*----> Raw Stack Dump <----*
01b2f9cc 23 3c 57 7c 0b 00 00 00 - e8 2f 08 00 01 00 00
00 #<W|...../......
01b2f9dc 01 00 00 00 00 00 00 00 - 28 00 00 00 00 00 00
00 ........(.......
01b2f9ec 01 00 00 00 a3 43 f8 77 - 03 01 00 00 24 fa b2
01 .....C.w....$...
01b2f9fc ae 3e 57 7c e5 03 00 00 - 04 ff b2 01 b3 da 57
7c .>W|..........W|
01b2fa0c 03 01 00 00 24 00 00 00 - 00 00 00 00 b4 ff b2
01 ....$...........
01b2fa1c ec 5b 14 76 e8 2f 08 00 - 01 00 00 00 00 00 00
00 .[.v./..........
01b2fa2c 00 00 00 00 01 00 00 00 - 24 eb cd 00 13 34 f8
77 ........$....4.w
01b2fa3c a8 64 9e 01 5c 00 5c 00 - 2e 00 5c 00 50 00 69
00 .d..\.\...\.P.i.
01b2fa4c 70 00 65 00 5c 00 53 00 - 70 00 6f 00 6f 00 6c
00 p.e.\.S.p.o.o.l.
01b2fa5c 65 00 72 00 5c 00 4c 00 - 50 00 54 00 31 00 00
00 e.r.\.L.P.T.1...
01b2fa6c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2fa7c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2fa8c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2fa9c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2faac 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2fabc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2facc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2fadc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2faec 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2fafc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
State Dump for Thread Id 0x468
eax=019f4738 ebx=00000000 ecx=019f0dd0 edx=00000000
esi=77f82865 edi=00000190
eip=77f82870 esp=01baff64 ebp=01baff88 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtWaitForSingleObject
77f82865 b8ea000000 mov eax,0xea
77f8286a 8d542404 lea edx,
[esp+0x4] ss:023c9e4b=????????
77f8286e cd2e int 2e
77f82870 c20c00 ret 0xc
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
01BAFF88 7C573B50 00000190 FFFFFFFF 00000000 76126FAC
ntdll!NtWaitForSingleObject
01BAFFB4 7C57438B 00C92148 00000000 000995E8 00C92148
kernel32!WaitForSingleObject
01BAFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x664
eax=020eff48 ebx=00000000 ecx=020eff48 edx=00000000
esi=77f82826 edi=020eff48
eip=77f82831 esp=020eff34 ebp=020eff50 iopl=0 nv
up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000206
function: NtDelayExecution
77f82826 b832000000 mov eax,0x32
77f8282b 8d542404 lea edx,
[esp+0x4] ss:02909e1b=????????
77f8282f cd2e int 2e
77f82831 c20800 ret 0x8
77f82834 53 push ebx
77f82835 51 push ecx
77f82836 6a00 push 0x0
77f82838 c70701000000 mov dword ptr
[edi],0x1 ds:020eff48=ff676980
77f8283e ff750c push dword ptr
[ebp+0xc] ss:02909e36=????????
77f82841 50 push eax
77f82842 e879fdffff call
RtlMultiByteToUnicodeN (77f825c0)
77f82847 e928fcffff jmp
RtlConsoleMultiByteToUnicodeN+0x333 (77f82474)
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
020EFF50 7C573A22 000003E8 00000000 75615450 000003E8
ntdll!NtDelayExecution
020EFFB4 7C57438B 00238EB0 00000000 00000000 00238EB0
kernel32!Sleep
020EFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x944
eax=00000102 ebx=ffffffff ecx=00010101 edx=00000000
esi=7fffffff edi=00000102
eip=77f82870 esp=0212fcac ebp=0212fce4 iopl=0 nv
up ei ng nz ac pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000293
function: NtWaitForSingleObject
77f82865 b8ea000000 mov eax,0xea
77f8286a 8d542404 lea edx,
[esp+0x4] ss:02949b93=????????
77f8286e cd2e int 2e
77f82870 c20c00 ret 0xc
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0212FCE4 74FD3C59 000004AC 0000049C 00000000 00000004
ntdll!NtWaitForSingleObject
0212FDD0 750312F5 0000049D 0212FE5C 00000000 00000000
msafd!WSPSetSockOpt
0212FE34 75615392 0000049D 0212FE5C 00000000 00000000
ws2_32!select
0212FF7C 780085BC 7561A218 77FCC3D5 00070000 0023E770
wsnmp32!SnmpSetPort
0212FFB4 7C57438B 0023E770 77FCC3D5 00070000 0023E770 !
endthreadex
0212FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0xa34
eax=00000000 ebx=802c0002 ecx=00000101 edx=00000000
esi=00092020 edi=00092060
eip=77f83310 esp=0264fe28 ebp=0264ff74 iopl=0 nv
up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000202
function: ZwReplyWaitReceivePortEx
77f83305 b8ac000000 mov eax,0xac
77f8330a 8d542404 lea edx,
[esp+0x4] ss:02e69d0f=????????
77f8330e cd2e int 2e
77f83310 c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0264FF74 77D37B4C 77D359C3 00092020 77D35216 01D3F9A8
ntdll!ZwReplyWaitReceivePortEx
0264FFA8 77D358D6 000740A8 0264FFEC 7C57438B 00157B10
rpcrt4!NdrCorrelationInitialize
0264FFB4 7C57438B 00157B10 77D35216 01D3F9A8 00157B10
rpcrt4!RpcBindingFree
0264FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x4fc
eax=00000000 ebx=00015f90 ecx=000003f0 edx=00000000
esi=000750d0 edi=00015f90
eip=77f8289c esp=03befebc ebp=03befee4 iopl=0 nv
up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000297
function: ZwRemoveIoCompletion
77f82891 b8a8000000 mov eax,0xa8
77f82896 8d542404 lea edx,
[esp+0x4] ss:04409da3=????????
77f8289a cd2e int 2e
77f8289c c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
03BEFEE4 77D31394 00000040 03BEFF1C 03BEFF0C 03BEFF14
ntdll!ZwRemoveIoCompletion
03BEFF20 77D3E93F 00015F90 03BEFF60 03BEFF5C 03BEFF70
rpcrt4!<nosymbols>
03BEFF74 77D3E8C2 77D35924 000750D0 00000000 00000000
rpcrt4!RpcRevertToSelf
03BEFFA8 77D358D6 01FADB50 03BEFFEC 7C57438B 0009D358
rpcrt4!RpcRevertToSelf
03BEFFB4 7C57438B 0009D358 00000000 00000000 0009D358
rpcrt4!RpcBindingFree
03BEFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x46c
eax=000002b6 ebx=80040001 ecx=00000010 edx=00000000
esi=000768c8 edi=000ca720
eip=77f83310 esp=07a0fe28 ebp=07a0ff74 iopl=0 nv
up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000202
function: ZwReplyWaitReceivePortEx
77f83305 b8ac000000 mov eax,0xac
77f8330a 8d542404 lea edx,
[esp+0x4] ss:08229d0f=????????
77f8330e cd2e int 2e
77f83310 c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
07A0FF74 77D37B4C 77D359C3 000768C8 079CF901 01A0D778
ntdll!ZwReplyWaitReceivePortEx
07A0FFA8 77D358D6 000740A8 07A0FFEC 7C57438B 01FBDCC0
rpcrt4!NdrCorrelationInitialize
07A0FFB4 7C57438B 01FBDCC0 079CF901 01A0D778 01FBDCC0
rpcrt4!RpcBindingFree
07A0FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x440
eax=00000000 ebx=77b2e72c ecx=0009cec8 edx=00000000
esi=00000440 edi=0009cec8
eip=77b0c010 esp=07ace610 ebp=07ace64c iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: StgGetIFillLockBytesOnFile
77b0bfef 8bf9 mov edi,ecx
77b0bff1 ff15a812a577 call dword ptr
[77a512a8] ds:77a512a8=7c573a71
77b0bff7 f6471801 test byte ptr
[edi+0x18],0x1 ds:008b6dae=??
77b0bffb 8bf0 mov esi,eax
77b0bffd a16ccfb277 mov eax,
[77b2cf6c] ds:77b2cf6c=34fd9000
77b0c002 89742428 mov
[esp+0x28],esi ss:082e84f7=????????
77b0c006 89442424 mov
[esp+0x24],eax ss:082e84f7=????????
77b0c00a 7506 jnz
StgGetIFillLockBytesOnFile+0xcf05 (77b14b12)
77b0c00c 8b07 mov eax,
[edi] ds:0009cec8=00000000
77b0c00e 8bcf mov ecx,edi
FAULT ->77b0c010 ff10 call dword ptr
[eax] ds:00000000=????????
77b0c012 397710 cmp
[edi+0x10],esi ds:008b6dae=????????
77b0c015 7509 jnz
StgGetIFillLockBytesOnFile+0xaa13 (77b12620)
77b0c017 66ff471a inc word ptr
[edi+0x1a] ds:008b6daf=????
77b0c01b e98a000000 jmp
StgGetIFillLockBytesOnFile+0x449d (77b0c0aa)
77b0c020 8364241800 and dword ptr
[esp+0x18],0x0 ss:082e84f7=????????
77b0c025 8b770c mov esi,
[edi+0xc] ds:008b6dae=????????
77b0c028 8d5f0c lea ebx,
[edi+0xc] ds:008b6dae=????????
77b0c02b 85f6 test esi,esi
77b0c02d 8bee mov ebp,esi
77b0c02f 7516 jnz
StgGetIFillLockBytesOnFile+0x9a3a (77b11647)
77b0c031 56 push esi
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
07ACE64C 77AC2D6B 0009CEC8 00000007 77B2E6E8 77B2E718
ole32!StgGetIFillLockBytesOnFile
07ACE7AC 77AC28A5 77A551B8 77A551B8 07ACE7EC 07ACE818
ole32!CoInstall
07ACE7EC 77AC2766 77B2E718 77A551A8 07ACE818 77B0B9E6
ole32!CoInstall
07ACE81C 77AC098F 77AC09D5 07ACEF70 07ACE868 00000000
ole32!CoInstall
07ACE840 77AC0D88 07ACE86C 07ACEF70 00000417 00000000
ole32!CoInstall
07ACEFFC 77ABAFB2 00000000 00000417 00000000 77A56548
ole32!CoInstall
07ACF028 77A90A3A 07ACF070 00000417 00000000 77A56548
ole32!CoRegisterSurrogate
07ACF048 77A91EA4 07ACF070 00000417 00000000 77A56548
ole32!CoGetClassObject
07ACF088 77A91B98 000B5BD0 07ACF124 07ACF0BC 07ACF0B8
ole32!CoGetObject
07ACF0C0 773B17FB 000B5BD0 07ACF124 07ACF0E4 07ACF0E8
ole32!MkParseDisplayName
07ACF0F0 773B175A 07ACF124 76124AE0 07ACF358 00000000
activeds!ADsGetObject
07ACF340 7614C70B 07ACF358 07ACF9B4 01A12948 00000000
activeds!ADsGetObject
07ACF35C 761264F0 00000000 07ACF780 00000000 00000000
localspl!SplXcvData
07ACF788 76145F5E 07ACF7AC 00000002 07ACF9B4 00000000
localspl!SplCreateSpooler
07ACFA04 76A9C836 00000000 000CAA84 07ACFA2C 000CAAB0
localspl!SplConfigChange
07ACFA34 010081EE 00000000 000CAA84 000CEC80 000CAAB0
spoolss!ClusterSplOpen
07ACFA54 01006CC8 00000000 000CAA84 000CEC80 000CAAB0
spoolsv!<nosymbols>
07ACFA74 77D32355 00000000 000CAA84 000CEC80 000CAAB0
spoolsv!YGetPrinterDriverDirectory
07ACFA9C 77D9356D 01006CAF 07ACFAB0 00000005 00000000
rpcrt4!CheckVerificationTrailer
07ACFD0C 77D93017 00000000 00000000 00077990 07ACFD24
rpcrt4!NdrStubCall2
07ACFD28 77D321E0 00077990 00077198 00077990 00000000
rpcrt4!NdrServerCall2
07ACFD60 77D320FE 010045FC 00077990 07ACFE0C 00077990
rpcrt4!I_RpcGetBufferWithObject
07ACFDB8 77D32021 0000004A 00000000 07ACFE0C 00000000
rpcrt4!I_RpcGetBufferWithObject
07ACFDD8 77D3748D 00077990 00000000 07ACFE0C 77F82091
rpcrt4!I_RpcGetBufferWithObject
07ACFE10 77D37030 00077730 000768C8 80020000 00000241
rpcrt4!RpcBindingFree
07ACFE28 77D37C1D 00077898 07ACFE50 00077730 07ACFF6C
rpcrt4!RpcBindingFree
07ACFF74 77D37B4C 77D359C3 000768C8 77D35216 07A0F9A8
rpcrt4!NdrCorrelationInitialize
07ACFFA8 77D358D6 000740A8 07ACFFEC 7C57438B 000B1838
rpcrt4!NdrCorrelationInitialize
07ACFFB4 7C57438B 000B1838 77D35216 07A0F9A8 000B1838
rpcrt4!RpcBindingFree
07ACFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
*----> Raw Stack Dump <----*
07ace610 e8 e6 b2 77 c8 ce 09 00 - 4c e6 ac 07 2c e7 b2
77 ...w....L...,..w
07ace620 00 00 00 00 f0 6e 0b 00 - 4c e6 ac 07 00 00 00
00 .....n..L.......
07ace630 00 00 00 00 00 90 fd 34 - 40 04 00 00 61 4c ac
77 [email protected]
07ace640 e8 e6 b2 77 07 00 00 00 - 2c e7 b2 77 ac e7 ac
07 ...w....,..w....
07ace650 6b 2d ac 77 c8 ce 09 00 - 07 00 00 00 e8 e6 b2
77 k-.w...........w
07ace660 18 e7 b2 77 20 3c ac 77 - 18 e7 b2 77 18 e7 b2
77 ...w <.w...w...w
07ace670 b8 51 a5 77 00 00 00 00 - 43 3a 5c 57 49 4e 4e
54 .Q.w....C:\WINNT
07ace680 5c 53 79 73 74 65 6d 33 - 32 5c 7e 43 4c 42 43
41 \System32\~CLBCA
07ace690 54 51 2e 44 4c 4c 00 00 - 00 00 00 00 fc ec ac
07 TQ.DLL..........
07ace6a0 03 00 00 00 8c 2a f8 77 - 00 00 07 00 18 07 07
00 .....*.w........
07ace6b0 03 00 00 00 f8 98 0c 00 - d4 ec ac 07 00 17 00
00 ................
07ace6c0 c4 ee ac 07 55 1f f8 77 - d0 2a f8 77 ff ff ff
ff ....U..w.*.w....
07ace6d0 d4 ee ac 07 d0 c1 fc 77 - 18 07 07 00 10 00 00
00 .......w........
07ace6e0 00 00 00 00 10 00 00 00 - ff ff ff ff f0 ee ac
07 ................
07ace6f0 d0 c1 fc 77 78 0a 07 00 - 01 00 00 00 99 00 00
00 ...wx...........
07ace700 9d 3a 57 7c 20 ed ac 07 - 80 06 00 00 10 ef ac
07 .:W| ...........
07ace710 55 1f f8 77 d0 2a f8 77 - ff ff ff ff 20 ef ac
07 U..w.*.w.... ...
07ace720 d0 c1 fc 77 38 0e 07 00 - dc ef ac 07 84 ef ac
07 ...w8...........
07ace730 3c 01 00 00 00 00 00 00 - 48 4d 46 50 31 00 ff
ff <.......HMFP1...
07ace740 44 ef ac 07 d0 c1 fc 77 - 01 00 00 00 01 00 00
00 D......w........
State Dump for Thread Id 0x77c
eax=00000000 ebx=80020000 ecx=7ffae000 edx=00000000
esi=000768c8 edi=00077730
eip=77f83310 esp=07b4fe28 ebp=07b4ff74 iopl=0 nv
up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000206
function: ZwReplyWaitReceivePortEx
77f83305 b8ac000000 mov eax,0xac
77f8330a 8d542404 lea edx,
[esp+0x4] ss:08369d0f=????????
77f8330e cd2e int 2e
77f83310 c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
07B4FF74 77D37B4C 77D35924 000768C8 07A0FAAC 77D45965
ntdll!ZwReplyWaitReceivePortEx
07B4FFA8 77D358D6 000B35A8 07B4FFEC 7C57438B 01FC40A0
rpcrt4!NdrCorrelationInitialize
07B4FFB4 7C57438B 01FC40A0 07A0FAAC 77D45965 01FC40A0
rpcrt4!RpcBindingFree
07B4FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x4ec
eax=0819f348 ebx=00015f90 ecx=0819db44 edx=00000000
esi=000750d0 edi=00015f90
eip=77f8289c esp=0819febc ebp=0819fee4 iopl=0 nv
up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000297
function: ZwRemoveIoCompletion
77f82891 b8a8000000 mov eax,0xa8
77f82896 8d542404 lea edx,
[esp+0x4] ss:089b9da3=????????
77f8289a cd2e int 2e
77f8289c c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0819FEE4 77D31394 00000044 0819FF1C 0819FF0C 0819FF14
ntdll!ZwRemoveIoCompletion
0819FF20 77D3E93F 00015F90 0819FF60 0819FF5C 0819FF70
rpcrt4!<nosymbols>
0819FF74 77D3E8C2 77D35924 000750D0 77F87E58 00000001
rpcrt4!RpcRevertToSelf
0819FFA8 77D358D6 01FE2810 0819FFEC 7C57438B 01FF9810
rpcrt4!RpcRevertToSelf
0819FFB4 7C57438B 01FF9810 77F87E58 00000001 01FF9810
rpcrt4!RpcBindingFree
0819FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x344
eax=000752d8 ebx=00015f90 ecx=000752d8 edx=00000000
esi=000750d0 edi=00015f90
eip=77f8289c esp=081dfebc ebp=081dfee4 iopl=0 nv
up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000297
function: ZwRemoveIoCompletion
77f82891 b8a8000000 mov eax,0xa8
77f82896 8d542404 lea edx,
[esp+0x4] ss:089f9da3=????????
77f8289a cd2e int 2e
77f8289c c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
081DFEE4 77D31394 00000044 081DFF1C 081DFF0C 081DFF14
ntdll!ZwRemoveIoCompletion
081DFF20 77D3E93F 00015F90 081DFF60 081DFF5C 081DFF70
rpcrt4!<nosymbols>
081DFF74 77D3E8C2 77D35924 000750D0 00000000 00000000
rpcrt4!RpcRevertToSelf
081DFFA8 77D358D6 000CF9C0 081DFFEC 7C57438B 01FFBF28
rpcrt4!RpcRevertToSelf
081DFFB4 7C57438B 01FFBF28 00000000 00000000 01FFBF28
rpcrt4!RpcBindingFree
081DFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x670
eax=77d358be ebx=00015f90 ecx=02080020 edx=00000000
esi=000750d0 edi=00015f90
eip=77f8289c esp=0821febc ebp=0821fee4 iopl=0 nv
up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000297
function: ZwRemoveIoCompletion
77f82891 b8a8000000 mov eax,0xa8
77f82896 8d542404 lea edx,
[esp+0x4] ss:08a39da3=????????
77f8289a cd2e int 2e
77f8289c c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0821FEE4 77D31394 00000040 0821FF1C 0821FF0C 0821FF14
ntdll!ZwRemoveIoCompletion
0821FF20 77D3E93F 00015F90 0821FF60 0821FF5C 0821FF70
rpcrt4!<nosymbols>
0821FF74 77D3E8C2 77D35924 000750D0 00000000 00000000
rpcrt4!RpcRevertToSelf
0821FFA8 77D358D6 000A4E68 0821FFEC 7C57438B 01FCD588
rpcrt4!RpcRevertToSelf
0821FFB4 7C57438B 01FCD588 00000000 00000000 01FCD588
rpcrt4!RpcBindingFree
0821FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
Thanks,
Kurt H
running File and Print services and Exchange 2000. Quite
often I find the print spooler service crashing and
unable to restart. In most cases I can restart the
service by using the cluster resource monitor in Cluster
Administrator and simply bringing the resource back
online. In rare cases the entire File and Print group
containing the Print Spooler resource will hang which
requires the active node of the server to actually be
rebooted or shut down to force the group to fail over.
I have been trying to troubleshoot this issue for months
because it is very annoying, but I can't find any
indication of what exactly is causing the print spooler
to crash, or what precise error message it is throwing.
Given this I have been reduced to trial and error and so
far I have been unsuccessful. I've tried several hotfixes
from Microsoft without luck, and I'm on the most current
service pack and hotfix levels (SP4).
I would like general assistance in troubleshooting
Windows Print Spooler issues, especially in a cluster
environment. I need to somehow log or diagnose what the
error condition is when the print spooler terminates so
that I can figure out what I need to change to correct
the problem.
I have the following output from the DRWTSN32.LOG file
but I am unable to decipher the exact cause of the error
from this information (below):
Application exception occurred:
App: spoolsv.exe (pid=2664)
When: 8/26/2004 @ 13:22:16.219
Exception number: c0000005 (access violation)
*----> System Information <----*
Computer Name: *******
User Name: SYSTEM
Number of Processors: 1
Processor Type: x86 Family 6 Model 11 Stepping 1
Windows 2000 Version: 5.0
Current Build: 2195
Service Pack: 4
Current Type: Uniprocessor Free
Registered Organization: **********
Registered Owner: *************
*----> Task List <----*
0 Idle.exe
8 System.exe
280 SMSS.exe
300 CSRSS.exe
296 WINLOGON.exe
352 SERVICES.exe
364 LSASS.exe
468 termsrv.exe
592 svchost.exe
640 svchost.exe
764 msdtc.exe
872 amgrsrvc.exe
888 ati2plxx.exe
908 dcevt32.exe
924 dcstor32.exe
1008 inetinfo.exe
1032 LLSSRV.exe
1072 ntfrs.exe
1164 portmap.exe
1200 qlremote.exe
1228 regsvc.exe
1240 mstask.exe
1356 omaws32.exe
1376 SNMP.exe
1548 WinMgmt.exe
1576 winvnc.exe
1588 MsPMSPSv.exe
1604 svchost.exe
1620 beremote.exe
1812 svchost.exe
1852 clussvc.exe
1904 dfssvc.exe
1948 mssearch.exe
2080 resrcmon.exe
2172 diagorb.exe
2404 svchost.exe
2648 explorer.exe
2712 atiptaxx.exe
2664 spoolsv.exe
2756 DRWTSN32.exe
0 _Total.exe
(01000000 - 0100D000)
(77F80000 - 77FFD000)
(78000000 - 78045000)
(7C570000 - 7C628000)
(7C2D0000 - 7C332000)
(77D30000 - 77DA1000)
(77F40000 - 77F7E000)
(77E10000 - 77E75000)
(76A90000 - 76AA6000)
(75030000 - 75044000)
(75020000 - 75028000)
(75170000 - 751BF000)
(7C340000 - 7C34F000)
(77BF0000 - 77C01000)
(77980000 - 779A4000)
(75050000 - 75058000)
(77950000 - 7797A000)
(751C0000 - 751C6000)
(75150000 - 7515F000)
(77340000 - 77353000)
(77520000 - 77525000)
(77320000 - 77337000)
(77A50000 - 77B3F000)
(779B0000 - 77A4B000)
(773B0000 - 773DF000)
(77380000 - 773A3000)
(77830000 - 7783E000)
(77880000 - 7790E000)
(7C0F0000 - 7C151000)
(774E0000 - 77513000)
(774C0000 - 774D1000)
(77530000 - 77552000)
(71710000 - 71794000)
(70A70000 - 70AD5000)
(77360000 - 77379000)
(777F0000 - 777F5000)
(76120000 - 76160000)
(77820000 - 77827000)
(759B0000 - 759B6000)
(76980000 - 7699B000)
(68010000 - 68100000)
(77800000 - 7781E000)
(76620000 - 76630000)
(733E0000 - 733EE000)
(6AA00000 - 6AA18000)
(10000000 - 10008000)
(00D20000 - 00D34000)
(01410000 - 0141B000)
(01530000 - 01544000)
(76AB0000 - 76AB7000)
(76A70000 - 76A76000)
(67200000 - 67217000)
(76A80000 - 76A8D000)
(75640000 - 75647000)
(75630000 - 75637000)
(754C0000 - 754C8000)
(75610000 - 7561D000)
(6B460000 - 6B467000)
(01AE0000 - 01AEF000)
(782C0000 - 782CC000)
(777E0000 - 777E8000)
(74FD0000 - 74FEE000)
(75010000 - 75017000)
(76A50000 - 76A6F000)
(76B00000 - 76B13000)
(775A0000 - 77630000)
(7CA00000 - 7CA23000)
(7C740000 - 7C7C7000)
(77430000 - 77440000)
(782F0000 - 78535000)
(78280000 - 782B6000)
(76670000 - 7667E000)
(73930000 - 73940000)
(74FF0000 - 75002000)
(76020000 - 76053000)
(76AC0000 - 76AFE000)
(03DB0000 - 03FBE000)
(76B30000 - 76B6E000)
(73280000 - 732B7000)
(6B2C0000 - 6B2C5000)
(10020000 - 101A4000)
State Dump for Thread Id 0xa5c
eax=0006fd38 ebx=00000000 ecx=00000101 edx=00000000
esi=00000000 edi=00000030
eip=77f82926 esp=0006fbf0 ebp=0006fc60 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtReadFile
77f8291b b8a1000000 mov eax,0xa1
77f82920 8d542404 lea edx,
[esp+0x4] ss:00889ad7=????????
77f82924 cd2e int 2e
77f82926 c22400 ret 0x24
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0006FC60 7C2E4CD9 00000030 0006FD38 00000216 0006FC88
ntdll!NtReadFile
0006FC8C 7C2E4B5F 00000030 0006FD38 00000216 0006FCC4
advapi32!StartServiceCtrlDispatcherW
0006FD08 7C2E486E 00000030 0006FD38 00000216 0105F89C
advapi32!StartServiceCtrlDispatcherW
0006FF68 01001295 0100B030 01001265 00000001 00232428
advapi32!StartServiceCtrlDispatcherW
0006FFC0 7C581AF6 0105F89C 0105F1D4 7FFDF000 00000000
spoolsv!<nosymbols>
0006FFF0 00000000 01001170 00000000 000000C8 00000100
kernel32!OpenEventA
*----> Raw Stack Dump <----*
0006fbf0 d1 85 57 7c 30 00 00 00 - 00 00 00 00 00 00 00
00 ..W|0...........
0006fc00 00 00 00 00 38 fc 06 00 - 38 fd 06 00 16 02 00
00 ....8...8.......
0006fc10 00 00 00 00 00 00 00 00 - c4 fc 06 00 46 85 57
7c ............F.W|
0006fc20 38 fd 06 00 00 00 00 00 - 01 00 00 00 d8 55 07
00 8............U..
0006fc30 4c fd 06 00 00 00 00 00 - 5c 00 00 00 00 3d 07
00 L.......\....=..
0006fc40 68 0a 00 00 00 00 00 00 - 18 fc 06 00 f8 fc 06
00 h...............
0006fc50 f8 fc 06 00 97 e5 57 7c - 00 86 57 7c ff ff ff
ff ......W|..W|....
0006fc60 8c fc 06 00 d9 4c 2e 7c - 30 00 00 00 38 fd 06
00 .....L.|0...8...
0006fc70 16 02 00 00 88 fc 06 00 - 00 00 00 00 d8 55 07
00 .............U..
0006fc80 38 fd 06 00 00 00 00 00 - 00 00 00 00 08 fd 06
00 8...............
0006fc90 5f 4b 2e 7c 30 00 00 00 - 38 fd 06 00 16 02 00
00 _K.|0...8.......
0006fca0 c4 fc 06 00 9c f8 05 01 - 00 00 00 00 00 f0 fd
7f ................
0006fcb0 86 af d3 77 10 43 07 00 - 4c fd 06 00 00 00 00
00 ...w.C..L.......
0006fcc0 f4 fc 06 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
0006fcd0 80 55 07 00 00 3d 07 00 - b0 02 00 00 70 00 65
00 .U...=......p.e.
0006fce0 35 00 35 00 01 00 00 00 - 8d 4e 2e 7c 00 00 00
00 5.5......N.|....
0006fcf0 a4 fc 06 00 10 43 07 00 - 58 ff 06 00 49 56 2e
7c .....C..X...IV.|
0006fd00 58 50 2e 7c ff ff ff ff - 68 ff 06 00 6e 48 2e
7c XP.|....h...nH.|
0006fd10 30 00 00 00 38 fd 06 00 - 16 02 00 00 9c f8 05
01 0...8...........
0006fd20 d4 f1 05 01 00 f0 fd 7f - 00 ff 06 00 55 1f f8
77 ............U..w
State Dump for Thread Id 0x2b0
eax=00000001 ebx=00000000 ecx=0028fbb0 edx=00000000
esi=77f82865 edi=0000005c
eip=77f82870 esp=0028ff60 ebp=0028ff84 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtWaitForSingleObject
77f82865 b8ea000000 mov eax,0xea
77f8286a 8d542404 lea edx,
[esp+0x4] ss:00aa9e47=????????
77f8286e cd2e int 2e
77f82870 c20c00 ret 0xc
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0028FF84 7C573B50 0000005C FFFFFFFF 00000000 010012DF
ntdll!NtWaitForSingleObject
0028FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!WaitForSingleObject
State Dump for Thread Id 0x694
eax=00000004 ebx=00015f90 ecx=002cf884 edx=00000000
esi=000750d0 edi=00015f90
eip=77f8289c esp=002cfebc ebp=002cfee4 iopl=0 nv
up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000297
function: ZwRemoveIoCompletion
77f82891 b8a8000000 mov eax,0xa8
77f82896 8d542404 lea edx,
[esp+0x4] ss:00ae9da3=????????
77f8289a cd2e int 2e
77f8289c c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
002CFEE4 77D31394 00000040 002CFF1C 002CFF0C 002CFF14
ntdll!ZwRemoveIoCompletion
002CFF20 77D3E93F 00015F90 002CFF60 002CFF5C 002CFF70
rpcrt4!<nosymbols>
002CFF74 77D3E8C2 77D35924 000750D0 0028FAF2 77F83413
rpcrt4!RpcRevertToSelf
002CFFA8 77D358D6 00076F00 002CFFEC 7C57438B 00076F28
rpcrt4!RpcRevertToSelf
002CFFB4 7C57438B 00076F28 0028FAF2 77F83413 00076F28
rpcrt4!RpcBindingFree
002CFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x5b4
eax=77f47ddd ebx=00079a14 ecx=7ffd9000 edx=00000000
esi=00077a04 edi=0100b3c0
eip=77f47de8 esp=007dff80 ebp=77f82091 iopl=0 nv
up ei ng nz ac po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000296
function: GdiGetSpoolMessage
77f47ddd b8c2100000 mov eax,0x10c2
77f47de2 8d542404 lea edx,
[esp+0x4] ss:00ff9e67=????????
77f47de6 cd2e int 2e
77f47de8 c21000 ret 0x10
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
77F82091 4AFFC033 21850F08 89000008 FF900C42 8D0F044A
gdi32!GdiGetSpoolMessage
0424548B 00000000 00000000 00000000 00000000 00000000
<nosymbols>
State Dump for Thread Id 0x2ac
eax=778321fe ebx=00000004 ecx=0081f234 edx=00000000
esi=77f82873 edi=00000004
eip=77f8287e esp=00c7fd24 ebp=00c7fd70 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtWaitForMultipleObjects
77f82873 b8e9000000 mov eax,0xe9
77f82878 8d542404 lea edx,
[esp+0x4] ss:01499c0b=????????
77f8287c cd2e int 2e
77f8287e c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00C7FD70 7C578F0D 00C7FD48 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
00C7FFB4 7C57438B 00000005 000B000A 7C325107 0007D528
kernel32!WaitForMultipleObjects
00C7FFEC 00000000 778321FE 0007D528 00000000 000000C8
kernel32!TlsSetValue
*----> Raw Stack Dump <----*
00c7fd24 23 3c 57 7c 04 00 00 00 - 48 fd c7 00 01 00 00
00 #<W|....H.......
00c7fd34 00 00 00 00 00 00 00 00 - 01 00 00 00 28 d5 07
00 ............(...
00c7fd44 01 00 00 00 e4 00 00 00 - e8 00 00 00 f8 00 00
00 ................
00c7fd54 84 01 00 00 38 bd 46 80 - c8 d2 bb 84 00 00 00
00 ....8.F.........
00c7fd64 f4 00 00 00 11 00 00 00 - 02 00 00 00 b4 ff c7
00 ................
00c7fd74 0d 8f 57 7c 48 fd c7 00 - 01 00 00 00 00 00 00
00 ..W|H...........
00c7fd84 00 00 00 00 00 00 00 00 - b2 22 83 77 04 00 00
00 .........".w....
00c7fd94 b0 fe c7 00 00 00 00 00 - ff ff ff ff 28 d5 07
00 ............(...
00c7fda4 07 51 32 7c 0a 00 0b 00 - a8 05 21 e3 ac 05 21
e3 .Q2|......!...!.
00c7fdb4 a0 81 e7 85 00 00 00 00 - 01 00 00 00 38 00 00
00 ............8...
00c7fdc4 23 00 00 00 23 00 00 00 - 0a 00 0b 00 07 51 32
7c #...#........Q2|
00c7fdd4 28 d5 07 00 ff ff ff ff - 34 f2 81 00 fe 21 83
77 (.......4....!.w
00c7fde4 f8 8b fd 7f 33 43 57 7c - 1b 00 00 00 00 02 00
00 ....3CW|........
00c7fdf4 fc ff c7 00 23 00 00 00 - 26 5a 45 80 80 1b 6d
be ....#...&ZE...m.
00c7fe04 08 12 ff 84 08 12 ff 84 - 40 00 00 00 24 1b 6d
be ........@...$.m.
00c7fe14 9d 01 45 80 00 fc ad 84 - 00 00 00 00 00 00 00
00 ..E.............
00c7fe24 28 72 c3 84 1e 53 49 80 - 28 72 c3 84 b8 00 00
00 (r...SI.(r......
00c7fe34 40 9a e7 85 03 00 10 00 - 08 12 ff 84 40 9a e7
85 @...........@...
00c7fe44 20 12 ff 84 08 12 ff 84 - 0c 12 ff 84 28 72 c3
84 ...........(r..
00c7fe54 a4 1b 6d be 01 00 00 00 - e0 fc ad 84 01 00 00
00 ..m.............
State Dump for Thread Id 0x590
eax=00000005 ebx=00000002 ecx=00cdf03a edx=00000000
esi=77f82873 edi=00000002
eip=77f8287e esp=00cdf838 ebp=00cdf884 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtWaitForMultipleObjects
77f82873 b8e9000000 mov eax,0xe9
77f82878 8d542404 lea edx,
[esp+0x4] ss:014f971f=????????
77f8287c cd2e int 2e
77f8287e c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00CDF884 77E119E6 00CDF85C 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
00CDF8E0 77E11ACE 00CDF8AC 00CDF928 FFFFFFFF 000000FF
user32!MsgWaitForMultipleObjectsEx
00CDF8FC 76A951A8 00000001 00CDF928 00000000 FFFFFFFF
user32!MsgWaitForMultipleObjects
FFFFFFFF 00000000 00000000 00000000 00000000 00000000
spoolss!EnumPrinterDriversW
*----> Raw Stack Dump <----*
00cdf838 23 3c 57 7c 02 00 00 00 - 5c f8 cd 00 01 00 00
00 #<W|....\.......
00cdf848 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
00cdf858 02 00 00 00 40 01 00 00 - 74 03 00 00 00 00 00
00 [email protected].......
00cdf868 70 f8 cd 00 00 00 00 00 - 70 f8 cd 00 70 f8 cd
00 p.......p...p...
00cdf878 ad aa e2 77 00 00 00 00 - 00 00 00 00 e0 f8 cd
00 ...w............
00cdf888 e6 19 e1 77 5c f8 cd 00 - 01 00 00 00 00 00 00
00 ...w\...........
00cdf898 00 00 00 00 00 00 00 00 - 7b 3a 57 7c e6 31 11
1b ........{:W|.1..
00cdf8a8 00 00 00 00 40 01 00 00 - 74 03 00 00 00 00 88
77 [email protected]
00cdf8b8 40 f9 cd 00 10 42 a9 76 - 9c 5d e3 77 00 00 88
77 @....B.v.].w...w
00cdf8c8 00 00 00 00 28 e5 09 00 - 00 00 00 00 cc 66 fd
7f ....(........f..
00cdf8d8 00 00 00 00 74 03 00 00 - fc f8 cd 00 ce 1a e1
77 ....t..........w
00cdf8e8 ac f8 cd 00 28 f9 cd 00 - ff ff ff ff ff 00 00
00 ....(...........
00cdf8f8 00 00 00 00 ff ff ff ff - a8 51 a9 76 01 00 00
00 .........Q.v....
00cdf908 28 f9 cd 00 00 00 00 00 - ff ff ff ff ff 00 00
00 (...............
00cdf918 db 1d 2d 7c 01 00 00 00 - b4 ff cd 00 00 00 00
00 ..-|............
00cdf928 40 01 00 00 00 00 00 00 - e0 b5 9e 01 05 00 00
00 @...............
00cdf938 05 00 00 00 02 00 00 00 - 01 00 00 00 b4 ff cd
00 ................
00cdf948 7e 98 a9 76 00 00 00 00 - 00 00 00 00 98 62 07
00 ~..v.........b..
00cdf958 69 00 6e 00 65 00 74 00 - 70 00 70 00 2e 00 64
00 i.n.e.t.p.p...d.
00cdf968 6c 00 6c 00 00 00 6c 00 - 00 00 00 00 00 00 00
00 l.l...l.........
State Dump for Thread Id 0x914
eax=76aa0364 ebx=00000001 ecx=00000000 edx=00000000
esi=77f82873 edi=00000001
eip=77f8287e esp=00d1ff0c ebp=00d1ff58 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtWaitForMultipleObjects
77f82873 b8e9000000 mov eax,0xe9
77f82878 8d542404 lea edx,
[esp+0x4] ss:01539df3=00000000
77f8287c cd2e int 2e
77f8287e c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
00D1FF58 7C578F0D 00D1FF30 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
00D1FFB4 7C57438B 00000128 00000000 00000000 00233A88
kernel32!WaitForMultipleObjects
00D1FFEC 00000000 76AA0364 00233A88 00000000 00905A4D
kernel32!TlsSetValue
*----> Raw Stack Dump <----*
00d1ff0c 23 3c 57 7c 01 00 00 00 - 30 ff d1 00 01 00 00
00 #<W|....0.......
00d1ff1c 00 00 00 00 00 00 00 00 - 00 00 00 00 88 3a 23
00 .............:#.
00d1ff2c 00 00 00 00 54 01 00 00 - dc ff d1 00 97 e5 57
7c ....T.........W|
00d1ff3c f8 84 57 7c ff ff ff ff - 78 ff d1 00 16 19 34
77 ..W|....x.....4w
00d1ff4c 28 01 00 00 38 00 12 00 - 00 00 00 00 b4 ff d1
00 (...8...........
00d1ff5c 0d 8f 57 7c 30 ff d1 00 - 01 00 00 00 00 00 00
00 ..W|0...........
00d1ff6c 00 00 00 00 00 00 00 00 - c4 03 aa 76 01 00 00
00 ...........v....
00d1ff7c a8 ff d1 00 00 00 00 00 - ff ff ff ff 00 00 00
00 ................
00d1ff8c 00 00 00 00 88 3a 23 00 - 03 01 00 00 00 00 00
00 .....:#.........
00d1ff9c 00 00 00 00 00 00 00 00 - 54 01 00 00 54 01 00
00 ........T...T...
00d1ffac 00 00 00 00 53 03 aa 76 - ec ff d1 00 8b 43 57
7c ....S..v.....CW|
00d1ffbc 28 01 00 00 00 00 00 00 - 00 00 00 00 88 3a 23
00 (............:#.
00d1ffcc 00 a0 fd 7f 00 00 00 00 - c0 ff d1 00 00 00 00
00 ................
00d1ffdc ff ff ff ff 97 e5 57 7c - a8 a0 57 7c 00 00 00
00 ......W|..W|....
00d1ffec 00 00 00 00 00 00 00 00 - 64 03 aa 76 88 3a 23
00 ........d..v.:#.
00d1fffc 00 00 00 00 4d 5a 90 00 - 03 00 00 00 04 00 00
00 ....MZ..........
00d2000c ff ff 00 00 b8 00 00 00 - 00 00 00 00 40 00 00
00 ............@...
00d2001c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
00d2002c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
00d2003c 80 00 00 00 0e 1f ba 0e - 00 b4 09 cd 21 b8 01
4c ............!..L
State Dump for Thread Id 0x934
eax=6720102d ebx=00000001 ecx=00000000 edx=00000000
esi=77f82873 edi=00000001
eip=77f8287e esp=0199fed0 ebp=0199ff1c iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtWaitForMultipleObjects
77f82873 b8e9000000 mov eax,0xe9
77f82878 8d542404 lea edx,
[esp+0x4] ss:021b9db7=????????
77f8287c cd2e int 2e
77f8287e c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0199FF1C 7C578F0D 0199FEF4 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
0199FFB4 7C57438B 00000000 00CDE764 67201AD7 00000000
kernel32!WaitForMultipleObjects
0199FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x8cc
eax=0000114d ebx=019dff88 ecx=019dfc44 edx=00000000
esi=77f82865 edi=00000224
eip=77f82870 esp=019dff6c ebp=019dff90 iopl=0 nv
up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000297
function: NtWaitForSingleObject
77f82865 b8ea000000 mov eax,0xea
77f8286a 8d542404 lea edx,
[esp+0x4] ss:021f9e53=????????
77f8286e cd2e int 2e
77f82870 c20c00 ret 0xc
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
019DFF90 7C573B50 00000224 00015F90 00000000 76A82DEC
ntdll!NtWaitForSingleObject
019DFFEC 00000000 76A82DC3 76A8A040 00000000 00000008
kernel32!WaitForSingleObject
*----> Raw Stack Dump <----*
019dff6c 28 3b 57 7c 24 02 00 00 - 00 00 00 00 88 ff 9d
01 (;W|$...........
019dff7c 00 00 00 00 40 a0 a8 76 - 40 a0 a8 76 00 17 5b
ca [email protected]@..v..[.
019dff8c ff ff ff ff ec ff 9d 01 - 50 3b 57 7c 24 02 00
00 ........P;W|$...
019dff9c 90 5f 01 00 00 00 00 00 - ec 2d a8 76 24 02 00
00 ._.......-.v$...
019dffac 90 5f 01 00 10 1d 08 00 - b8 8b f8 77 8b 43 57
7c ._.........w.CW|
019dffbc 40 a0 a8 76 10 1d 08 00 - b8 8b f8 77 40 a0 a8
76 @[email protected]
019dffcc 00 40 fd 7f 30 e4 cd 00 - c0 ff 9d 01 30 e4 cd
00 [email protected]...
019dffdc ff ff ff ff 97 e5 57 7c - a8 a0 57 7c 00 00 00
00 ......W|..W|....
019dffec 00 00 00 00 00 00 00 00 - c3 2d a8 76 40 a0 a8
76 [email protected]
019dfffc 00 00 00 00 08 00 00 00 - 01 01 00 00 ee ff ee
ff ................
019e000c 00 00 00 00 00 00 c9 00 - 00 40 0b 00 00 00 9e
01 .........@......
019e001c 00 01 00 00 40 00 9e 01 - 00 00 ae 01 b7 00 00
00 ....@...........
019e002c 02 00 00 00 a8 05 c9 00 - 00 00 00 00 10 3d a2
01 .............=..
019e003c 00 00 00 00 24 00 08 00 - 01 01 0a 00 55 00 4e
00 ....$.......U.N.
019e004c 49 00 52 00 45 00 53 00 - 2e 00 44 00 4c 00 4c
00 I.R.E.S...D.L.L.
019e005c 00 00 53 00 54 00 44 00 - 4e 00 41 00 4d 00 45
00 ..S.T.D.N.A.M.E.
019e006c 53 00 2e 00 47 00 50 00 - 44 00 00 00 48 00 50
00 S...G.P.D...H.P.
019e007c 56 00 44 00 4a 00 35 00 - 30 00 2e 00 49 00 4e
00 V.D.J.5.0...I.N.
019e008c 49 00 00 00 48 00 50 00 - 56 00 55 00 44 00 35
00 I...H.P.V.U.D.5.
019e009c 30 00 2e 00 44 00 4c 00 - 4c 00 00 00 48 00 50
00 0...D.L.L...H.P.
State Dump for Thread Id 0x1ec
eax=76145ac9 ebx=0000000b ecx=77f87c5e edx=00000000
esi=77f82873 edi=0000000b
eip=77f8287e esp=01b2f9cc ebp=01b2fa18 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtWaitForMultipleObjects
77f82873 b8e9000000 mov eax,0xe9
77f82878 8d542404 lea edx,
[esp+0x4] ss:023498b3=????????
77f8287c cd2e int 2e
77f8287e c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
01B2FA18 76145BEC 00082FE8 00000001 00000000 00000000
ntdll!NtWaitForMultipleObjects
01B2FFB4 7C57438B 019E64A8 00CDEB24 77F83413 019E64A8
localspl!SplConfigChange
01B2FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
*----> Raw Stack Dump <----*
01b2f9cc 23 3c 57 7c 0b 00 00 00 - e8 2f 08 00 01 00 00
00 #<W|...../......
01b2f9dc 01 00 00 00 00 00 00 00 - 28 00 00 00 00 00 00
00 ........(.......
01b2f9ec 01 00 00 00 a3 43 f8 77 - 03 01 00 00 24 fa b2
01 .....C.w....$...
01b2f9fc ae 3e 57 7c e5 03 00 00 - 04 ff b2 01 b3 da 57
7c .>W|..........W|
01b2fa0c 03 01 00 00 24 00 00 00 - 00 00 00 00 b4 ff b2
01 ....$...........
01b2fa1c ec 5b 14 76 e8 2f 08 00 - 01 00 00 00 00 00 00
00 .[.v./..........
01b2fa2c 00 00 00 00 01 00 00 00 - 24 eb cd 00 13 34 f8
77 ........$....4.w
01b2fa3c a8 64 9e 01 5c 00 5c 00 - 2e 00 5c 00 50 00 69
00 .d..\.\...\.P.i.
01b2fa4c 70 00 65 00 5c 00 53 00 - 70 00 6f 00 6f 00 6c
00 p.e.\.S.p.o.o.l.
01b2fa5c 65 00 72 00 5c 00 4c 00 - 50 00 54 00 31 00 00
00 e.r.\.L.P.T.1...
01b2fa6c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2fa7c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2fa8c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2fa9c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2faac 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2fabc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2facc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2fadc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2faec 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
01b2fafc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00
00 ................
State Dump for Thread Id 0x468
eax=019f4738 ebx=00000000 ecx=019f0dd0 edx=00000000
esi=77f82865 edi=00000190
eip=77f82870 esp=01baff64 ebp=01baff88 iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: NtWaitForSingleObject
77f82865 b8ea000000 mov eax,0xea
77f8286a 8d542404 lea edx,
[esp+0x4] ss:023c9e4b=????????
77f8286e cd2e int 2e
77f82870 c20c00 ret 0xc
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
01BAFF88 7C573B50 00000190 FFFFFFFF 00000000 76126FAC
ntdll!NtWaitForSingleObject
01BAFFB4 7C57438B 00C92148 00000000 000995E8 00C92148
kernel32!WaitForSingleObject
01BAFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x664
eax=020eff48 ebx=00000000 ecx=020eff48 edx=00000000
esi=77f82826 edi=020eff48
eip=77f82831 esp=020eff34 ebp=020eff50 iopl=0 nv
up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000206
function: NtDelayExecution
77f82826 b832000000 mov eax,0x32
77f8282b 8d542404 lea edx,
[esp+0x4] ss:02909e1b=????????
77f8282f cd2e int 2e
77f82831 c20800 ret 0x8
77f82834 53 push ebx
77f82835 51 push ecx
77f82836 6a00 push 0x0
77f82838 c70701000000 mov dword ptr
[edi],0x1 ds:020eff48=ff676980
77f8283e ff750c push dword ptr
[ebp+0xc] ss:02909e36=????????
77f82841 50 push eax
77f82842 e879fdffff call
RtlMultiByteToUnicodeN (77f825c0)
77f82847 e928fcffff jmp
RtlConsoleMultiByteToUnicodeN+0x333 (77f82474)
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
020EFF50 7C573A22 000003E8 00000000 75615450 000003E8
ntdll!NtDelayExecution
020EFFB4 7C57438B 00238EB0 00000000 00000000 00238EB0
kernel32!Sleep
020EFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x944
eax=00000102 ebx=ffffffff ecx=00010101 edx=00000000
esi=7fffffff edi=00000102
eip=77f82870 esp=0212fcac ebp=0212fce4 iopl=0 nv
up ei ng nz ac pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000293
function: NtWaitForSingleObject
77f82865 b8ea000000 mov eax,0xea
77f8286a 8d542404 lea edx,
[esp+0x4] ss:02949b93=????????
77f8286e cd2e int 2e
77f82870 c20c00 ret 0xc
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0212FCE4 74FD3C59 000004AC 0000049C 00000000 00000004
ntdll!NtWaitForSingleObject
0212FDD0 750312F5 0000049D 0212FE5C 00000000 00000000
msafd!WSPSetSockOpt
0212FE34 75615392 0000049D 0212FE5C 00000000 00000000
ws2_32!select
0212FF7C 780085BC 7561A218 77FCC3D5 00070000 0023E770
wsnmp32!SnmpSetPort
0212FFB4 7C57438B 0023E770 77FCC3D5 00070000 0023E770 !
endthreadex
0212FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0xa34
eax=00000000 ebx=802c0002 ecx=00000101 edx=00000000
esi=00092020 edi=00092060
eip=77f83310 esp=0264fe28 ebp=0264ff74 iopl=0 nv
up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000202
function: ZwReplyWaitReceivePortEx
77f83305 b8ac000000 mov eax,0xac
77f8330a 8d542404 lea edx,
[esp+0x4] ss:02e69d0f=????????
77f8330e cd2e int 2e
77f83310 c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0264FF74 77D37B4C 77D359C3 00092020 77D35216 01D3F9A8
ntdll!ZwReplyWaitReceivePortEx
0264FFA8 77D358D6 000740A8 0264FFEC 7C57438B 00157B10
rpcrt4!NdrCorrelationInitialize
0264FFB4 7C57438B 00157B10 77D35216 01D3F9A8 00157B10
rpcrt4!RpcBindingFree
0264FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x4fc
eax=00000000 ebx=00015f90 ecx=000003f0 edx=00000000
esi=000750d0 edi=00015f90
eip=77f8289c esp=03befebc ebp=03befee4 iopl=0 nv
up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000297
function: ZwRemoveIoCompletion
77f82891 b8a8000000 mov eax,0xa8
77f82896 8d542404 lea edx,
[esp+0x4] ss:04409da3=????????
77f8289a cd2e int 2e
77f8289c c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
03BEFEE4 77D31394 00000040 03BEFF1C 03BEFF0C 03BEFF14
ntdll!ZwRemoveIoCompletion
03BEFF20 77D3E93F 00015F90 03BEFF60 03BEFF5C 03BEFF70
rpcrt4!<nosymbols>
03BEFF74 77D3E8C2 77D35924 000750D0 00000000 00000000
rpcrt4!RpcRevertToSelf
03BEFFA8 77D358D6 01FADB50 03BEFFEC 7C57438B 0009D358
rpcrt4!RpcRevertToSelf
03BEFFB4 7C57438B 0009D358 00000000 00000000 0009D358
rpcrt4!RpcBindingFree
03BEFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x46c
eax=000002b6 ebx=80040001 ecx=00000010 edx=00000000
esi=000768c8 edi=000ca720
eip=77f83310 esp=07a0fe28 ebp=07a0ff74 iopl=0 nv
up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000202
function: ZwReplyWaitReceivePortEx
77f83305 b8ac000000 mov eax,0xac
77f8330a 8d542404 lea edx,
[esp+0x4] ss:08229d0f=????????
77f8330e cd2e int 2e
77f83310 c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
07A0FF74 77D37B4C 77D359C3 000768C8 079CF901 01A0D778
ntdll!ZwReplyWaitReceivePortEx
07A0FFA8 77D358D6 000740A8 07A0FFEC 7C57438B 01FBDCC0
rpcrt4!NdrCorrelationInitialize
07A0FFB4 7C57438B 01FBDCC0 079CF901 01A0D778 01FBDCC0
rpcrt4!RpcBindingFree
07A0FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x440
eax=00000000 ebx=77b2e72c ecx=0009cec8 edx=00000000
esi=00000440 edi=0009cec8
eip=77b0c010 esp=07ace610 ebp=07ace64c iopl=0 nv
up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000246
function: StgGetIFillLockBytesOnFile
77b0bfef 8bf9 mov edi,ecx
77b0bff1 ff15a812a577 call dword ptr
[77a512a8] ds:77a512a8=7c573a71
77b0bff7 f6471801 test byte ptr
[edi+0x18],0x1 ds:008b6dae=??
77b0bffb 8bf0 mov esi,eax
77b0bffd a16ccfb277 mov eax,
[77b2cf6c] ds:77b2cf6c=34fd9000
77b0c002 89742428 mov
[esp+0x28],esi ss:082e84f7=????????
77b0c006 89442424 mov
[esp+0x24],eax ss:082e84f7=????????
77b0c00a 7506 jnz
StgGetIFillLockBytesOnFile+0xcf05 (77b14b12)
77b0c00c 8b07 mov eax,
[edi] ds:0009cec8=00000000
77b0c00e 8bcf mov ecx,edi
FAULT ->77b0c010 ff10 call dword ptr
[eax] ds:00000000=????????
77b0c012 397710 cmp
[edi+0x10],esi ds:008b6dae=????????
77b0c015 7509 jnz
StgGetIFillLockBytesOnFile+0xaa13 (77b12620)
77b0c017 66ff471a inc word ptr
[edi+0x1a] ds:008b6daf=????
77b0c01b e98a000000 jmp
StgGetIFillLockBytesOnFile+0x449d (77b0c0aa)
77b0c020 8364241800 and dword ptr
[esp+0x18],0x0 ss:082e84f7=????????
77b0c025 8b770c mov esi,
[edi+0xc] ds:008b6dae=????????
77b0c028 8d5f0c lea ebx,
[edi+0xc] ds:008b6dae=????????
77b0c02b 85f6 test esi,esi
77b0c02d 8bee mov ebp,esi
77b0c02f 7516 jnz
StgGetIFillLockBytesOnFile+0x9a3a (77b11647)
77b0c031 56 push esi
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
07ACE64C 77AC2D6B 0009CEC8 00000007 77B2E6E8 77B2E718
ole32!StgGetIFillLockBytesOnFile
07ACE7AC 77AC28A5 77A551B8 77A551B8 07ACE7EC 07ACE818
ole32!CoInstall
07ACE7EC 77AC2766 77B2E718 77A551A8 07ACE818 77B0B9E6
ole32!CoInstall
07ACE81C 77AC098F 77AC09D5 07ACEF70 07ACE868 00000000
ole32!CoInstall
07ACE840 77AC0D88 07ACE86C 07ACEF70 00000417 00000000
ole32!CoInstall
07ACEFFC 77ABAFB2 00000000 00000417 00000000 77A56548
ole32!CoInstall
07ACF028 77A90A3A 07ACF070 00000417 00000000 77A56548
ole32!CoRegisterSurrogate
07ACF048 77A91EA4 07ACF070 00000417 00000000 77A56548
ole32!CoGetClassObject
07ACF088 77A91B98 000B5BD0 07ACF124 07ACF0BC 07ACF0B8
ole32!CoGetObject
07ACF0C0 773B17FB 000B5BD0 07ACF124 07ACF0E4 07ACF0E8
ole32!MkParseDisplayName
07ACF0F0 773B175A 07ACF124 76124AE0 07ACF358 00000000
activeds!ADsGetObject
07ACF340 7614C70B 07ACF358 07ACF9B4 01A12948 00000000
activeds!ADsGetObject
07ACF35C 761264F0 00000000 07ACF780 00000000 00000000
localspl!SplXcvData
07ACF788 76145F5E 07ACF7AC 00000002 07ACF9B4 00000000
localspl!SplCreateSpooler
07ACFA04 76A9C836 00000000 000CAA84 07ACFA2C 000CAAB0
localspl!SplConfigChange
07ACFA34 010081EE 00000000 000CAA84 000CEC80 000CAAB0
spoolss!ClusterSplOpen
07ACFA54 01006CC8 00000000 000CAA84 000CEC80 000CAAB0
spoolsv!<nosymbols>
07ACFA74 77D32355 00000000 000CAA84 000CEC80 000CAAB0
spoolsv!YGetPrinterDriverDirectory
07ACFA9C 77D9356D 01006CAF 07ACFAB0 00000005 00000000
rpcrt4!CheckVerificationTrailer
07ACFD0C 77D93017 00000000 00000000 00077990 07ACFD24
rpcrt4!NdrStubCall2
07ACFD28 77D321E0 00077990 00077198 00077990 00000000
rpcrt4!NdrServerCall2
07ACFD60 77D320FE 010045FC 00077990 07ACFE0C 00077990
rpcrt4!I_RpcGetBufferWithObject
07ACFDB8 77D32021 0000004A 00000000 07ACFE0C 00000000
rpcrt4!I_RpcGetBufferWithObject
07ACFDD8 77D3748D 00077990 00000000 07ACFE0C 77F82091
rpcrt4!I_RpcGetBufferWithObject
07ACFE10 77D37030 00077730 000768C8 80020000 00000241
rpcrt4!RpcBindingFree
07ACFE28 77D37C1D 00077898 07ACFE50 00077730 07ACFF6C
rpcrt4!RpcBindingFree
07ACFF74 77D37B4C 77D359C3 000768C8 77D35216 07A0F9A8
rpcrt4!NdrCorrelationInitialize
07ACFFA8 77D358D6 000740A8 07ACFFEC 7C57438B 000B1838
rpcrt4!NdrCorrelationInitialize
07ACFFB4 7C57438B 000B1838 77D35216 07A0F9A8 000B1838
rpcrt4!RpcBindingFree
07ACFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
*----> Raw Stack Dump <----*
07ace610 e8 e6 b2 77 c8 ce 09 00 - 4c e6 ac 07 2c e7 b2
77 ...w....L...,..w
07ace620 00 00 00 00 f0 6e 0b 00 - 4c e6 ac 07 00 00 00
00 .....n..L.......
07ace630 00 00 00 00 00 90 fd 34 - 40 04 00 00 61 4c ac
77 [email protected]
07ace640 e8 e6 b2 77 07 00 00 00 - 2c e7 b2 77 ac e7 ac
07 ...w....,..w....
07ace650 6b 2d ac 77 c8 ce 09 00 - 07 00 00 00 e8 e6 b2
77 k-.w...........w
07ace660 18 e7 b2 77 20 3c ac 77 - 18 e7 b2 77 18 e7 b2
77 ...w <.w...w...w
07ace670 b8 51 a5 77 00 00 00 00 - 43 3a 5c 57 49 4e 4e
54 .Q.w....C:\WINNT
07ace680 5c 53 79 73 74 65 6d 33 - 32 5c 7e 43 4c 42 43
41 \System32\~CLBCA
07ace690 54 51 2e 44 4c 4c 00 00 - 00 00 00 00 fc ec ac
07 TQ.DLL..........
07ace6a0 03 00 00 00 8c 2a f8 77 - 00 00 07 00 18 07 07
00 .....*.w........
07ace6b0 03 00 00 00 f8 98 0c 00 - d4 ec ac 07 00 17 00
00 ................
07ace6c0 c4 ee ac 07 55 1f f8 77 - d0 2a f8 77 ff ff ff
ff ....U..w.*.w....
07ace6d0 d4 ee ac 07 d0 c1 fc 77 - 18 07 07 00 10 00 00
00 .......w........
07ace6e0 00 00 00 00 10 00 00 00 - ff ff ff ff f0 ee ac
07 ................
07ace6f0 d0 c1 fc 77 78 0a 07 00 - 01 00 00 00 99 00 00
00 ...wx...........
07ace700 9d 3a 57 7c 20 ed ac 07 - 80 06 00 00 10 ef ac
07 .:W| ...........
07ace710 55 1f f8 77 d0 2a f8 77 - ff ff ff ff 20 ef ac
07 U..w.*.w.... ...
07ace720 d0 c1 fc 77 38 0e 07 00 - dc ef ac 07 84 ef ac
07 ...w8...........
07ace730 3c 01 00 00 00 00 00 00 - 48 4d 46 50 31 00 ff
ff <.......HMFP1...
07ace740 44 ef ac 07 d0 c1 fc 77 - 01 00 00 00 01 00 00
00 D......w........
State Dump for Thread Id 0x77c
eax=00000000 ebx=80020000 ecx=7ffae000 edx=00000000
esi=000768c8 edi=00077730
eip=77f83310 esp=07b4fe28 ebp=07b4ff74 iopl=0 nv
up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000206
function: ZwReplyWaitReceivePortEx
77f83305 b8ac000000 mov eax,0xac
77f8330a 8d542404 lea edx,
[esp+0x4] ss:08369d0f=????????
77f8330e cd2e int 2e
77f83310 c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
07B4FF74 77D37B4C 77D35924 000768C8 07A0FAAC 77D45965
ntdll!ZwReplyWaitReceivePortEx
07B4FFA8 77D358D6 000B35A8 07B4FFEC 7C57438B 01FC40A0
rpcrt4!NdrCorrelationInitialize
07B4FFB4 7C57438B 01FC40A0 07A0FAAC 77D45965 01FC40A0
rpcrt4!RpcBindingFree
07B4FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x4ec
eax=0819f348 ebx=00015f90 ecx=0819db44 edx=00000000
esi=000750d0 edi=00015f90
eip=77f8289c esp=0819febc ebp=0819fee4 iopl=0 nv
up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000297
function: ZwRemoveIoCompletion
77f82891 b8a8000000 mov eax,0xa8
77f82896 8d542404 lea edx,
[esp+0x4] ss:089b9da3=????????
77f8289a cd2e int 2e
77f8289c c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0819FEE4 77D31394 00000044 0819FF1C 0819FF0C 0819FF14
ntdll!ZwRemoveIoCompletion
0819FF20 77D3E93F 00015F90 0819FF60 0819FF5C 0819FF70
rpcrt4!<nosymbols>
0819FF74 77D3E8C2 77D35924 000750D0 77F87E58 00000001
rpcrt4!RpcRevertToSelf
0819FFA8 77D358D6 01FE2810 0819FFEC 7C57438B 01FF9810
rpcrt4!RpcRevertToSelf
0819FFB4 7C57438B 01FF9810 77F87E58 00000001 01FF9810
rpcrt4!RpcBindingFree
0819FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x344
eax=000752d8 ebx=00015f90 ecx=000752d8 edx=00000000
esi=000750d0 edi=00015f90
eip=77f8289c esp=081dfebc ebp=081dfee4 iopl=0 nv
up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000297
function: ZwRemoveIoCompletion
77f82891 b8a8000000 mov eax,0xa8
77f82896 8d542404 lea edx,
[esp+0x4] ss:089f9da3=????????
77f8289a cd2e int 2e
77f8289c c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
081DFEE4 77D31394 00000044 081DFF1C 081DFF0C 081DFF14
ntdll!ZwRemoveIoCompletion
081DFF20 77D3E93F 00015F90 081DFF60 081DFF5C 081DFF70
rpcrt4!<nosymbols>
081DFF74 77D3E8C2 77D35924 000750D0 00000000 00000000
rpcrt4!RpcRevertToSelf
081DFFA8 77D358D6 000CF9C0 081DFFEC 7C57438B 01FFBF28
rpcrt4!RpcRevertToSelf
081DFFB4 7C57438B 01FFBF28 00000000 00000000 01FFBF28
rpcrt4!RpcBindingFree
081DFFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
State Dump for Thread Id 0x670
eax=77d358be ebx=00015f90 ecx=02080020 edx=00000000
esi=000750d0 edi=00015f90
eip=77f8289c esp=0821febc ebp=0821fee4 iopl=0 nv
up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038
gs=0000 efl=00000297
function: ZwRemoveIoCompletion
77f82891 b8a8000000 mov eax,0xa8
77f82896 8d542404 lea edx,
[esp+0x4] ss:08a39da3=????????
77f8289a cd2e int 2e
77f8289c c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4
Function Name
0821FEE4 77D31394 00000040 0821FF1C 0821FF0C 0821FF14
ntdll!ZwRemoveIoCompletion
0821FF20 77D3E93F 00015F90 0821FF60 0821FF5C 0821FF70
rpcrt4!<nosymbols>
0821FF74 77D3E8C2 77D35924 000750D0 00000000 00000000
rpcrt4!RpcRevertToSelf
0821FFA8 77D358D6 000A4E68 0821FFEC 7C57438B 01FCD588
rpcrt4!RpcRevertToSelf
0821FFB4 7C57438B 01FCD588 00000000 00000000 01FCD588
rpcrt4!RpcBindingFree
0821FFEC 00000000 00000000 00000000 00000000 00000000
kernel32!TlsSetValue
Thanks,
Kurt H